CVE-2024-38104
Published: 09 July 2024
Summary
CVE-2024-38104 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 8.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a remote code execution flaw in the Windows Fax Service, tracked as CVE-2024-38104 with a CVSS score of 8.8. It affects the fax component in supported Windows operating systems and is associated with weaknesses in improper input validation and out-of-bounds memory access.
An attacker with low-privileged network access can exploit the issue without user interaction to achieve arbitrary code execution, resulting in full confidentiality, integrity, and availability impact on the target system. The attack vector is rated as remotely exploitable over the network with low attack complexity.
Microsoft Security Response Center advisories for this CVE detail available security updates that address the vulnerability through patching of the affected fax service components. Organizations are advised to apply the updates according to their standard deployment processes to eliminate the exposure.
EPSS scores for the CVE reached a peak of 0.0913 before settling at the current value of 0.0675, indicating modest post-disclosure interest without evidence of widespread exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37789
Vulnerability details
Windows Fax Service Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.
Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.
Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.
Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.